fix(x402): derive payment-identifier with HMAC from account secret (#434)

[gewenbo888]

Closes #434.

Why

Since #427, derivePaymentIdentifier(txHex) generated the payment identifier from pay_ + SHA256(tx bytes)[:32]. While this solved #420 (cross-process and retry idempotency), signed transaction bytes become public once broadcast to the mempool.

For resource servers (such as Vibewatch Stacks Vibe Index v2026.09.24+) that treat the payment-identifier as proof of ownership for re-fetching paid responses after network hiccups or proxy 502s, a publicly-derivable identifier cannot prove claimant ownership. Consequently, retrying clients receive 403 payment_identifier_required instead of the stored paid response.

What

1. HMAC-Keyed Derivation (src/lib/utils/x402-protocol.ts):
   • derivePaymentIdentifier(txHex: string, secretKey?: string): string
   • When secretKey (e.g., account privateKey) is provided, derives pay_ + HMAC-SHA256(secretKey, txHex)[:32].
   • Stays 100% deterministic across retries and separate CLI processes for the payer (payment identifier regenerated per retry defeats relay idempotency #420).
   • Unguessable from public mempool transaction bytes alone (x402: tx-derived payment-identifier is computable from public tx bytes, so it can't prove the claimant on retry #434), proving legitimate wallet ownership to resource servers.
   • Preserves backwards-compatible fallback to plain SHA256 if secretKey is omitted.
2. Key Injection:
   • Passed account.privateKey to derivePaymentIdentifier in createApiClient (src/lib/services/x402.service.ts) and executeInboxWithRetry (src/lib/utils/x402-retry.ts).
3. Honour Server-Issued Identifiers:
   • Added extractServerIssuedPaymentIdentifier() in x402-retry.ts to honour server-issued identifiers returned in response envelopes (paymentId, payment_identifier, payment-identifier.info.id) or payment-response header extensions on both success and error/retry paths.
   • Added optional extensions to SettlementResponseV2.
4. Comprehensive Tests:
   • src/lib/utils/x402-protocol.test.ts: Added tests for HMAC secret-keyed derivation determinism, mempool unguessability, and secret differentiation.
   • src/lib/utils/x402-retry.test.ts: Added tests for server-issued payment identifier extraction across header extensions and response bodies.
   • src/lib/services/x402.direct.test.ts: Verified re-signing test passes with HMAC-derived identifiers.
   • bun run typecheck (tsc --noEmit) passes with 0 errors.

Payout designation:

• EVM: 0x240C74A953Fc04Fe8cD713c68b53e94d9b449F8C
• ENS: gewenbo.eth

[biwasxyz]

Reviewed. The HMAC derivation is the right fix for #434: deterministic for the payer (#420 re-sign test still passes), not computable from mempool bytes.

Pushed one fixup commit (dd18c18) on top:

1. derivePaymentIdentifier now requires the secret. The plain-SHA256 fallback was unused by any caller and would silently reopen #434 for a future one (as sonic-mast flagged on the issue). Tests updated, including one that pins the identifier ≠ the public hash.
2. On the inbox failure path, the canonical tracking hint now ranks above the payment-response header id. x402 v2 servers may echo the client's own payment-identifier extension there, and that echo shouldn't mask the relay-owned paymentId used for status polling.

Typecheck clean; x402-protocol/x402-retry 16/16 and x402.direct 42/42 pass. Thanks!